| @@ -9,9 +9,9 @@ | ||
| 9 | 9 | |
| 10 | 10 | /** |
| 11 | 11 | * Implementation of XMB Forum converter. |
| 12 | 12 | * |
| 13 | - * @since 2.5.0 bbPress (r5143) | |
| 13 | + * @since 2.5.0 bbPress (r5144) | |
| 14 | 14 | * |
| 15 | 15 | * @link Codex Docs https://codex.bbpress.org/import-forums/xmb |
| 16 | 16 | */ |
| 17 | 17 | class XMB extends BBP_Converter_Base { |
| @@ -484,19 +484,11 @@ | ||
| 484 | 484 | 'to_fieldname' => '_bbp_password', |
| 485 | 485 | 'callback_method' => 'callback_savepass' |
| 486 | 486 | ); |
| 487 | 487 | |
| 488 | - // Store old User Salt (This is only used for the SELECT row info for the above password save) | |
| 489 | -// $this->field_map[] = array( | |
| 490 | -// 'from_tablename' => 'members', | |
| 491 | -// 'from_fieldname' => 'salt', | |
| 492 | -// 'to_type' => 'user', | |
| 493 | -// 'to_fieldname' => '' | |
| 494 | -// ); | |
| 495 | - | |
| 496 | 488 | // User password verify class (Stored in usermeta for verifying password) |
| 497 | 489 | $this->field_map[] = array( |
| 498 | - 'to_type' => 'members', | |
| 490 | + 'to_type' => 'user', | |
| 499 | 491 | 'to_fieldname' => '_bbp_class', |
| 500 | 492 | 'default' => 'XMB' |
| 501 | 493 | ); |
| 502 | 494 | |
| @@ -624,19 +616,13 @@ | ||
| 624 | 616 | return ''; |
| 625 | 617 | } |
| 626 | 618 | |
| 627 | 619 | /** |
| 628 | - * This method is to save the salt and password together. That | |
| 629 | - * way when we authenticate it we can get it out of the database | |
| 630 | - * as one value. Array values are auto sanitized by WordPress. | |
| 620 | + * Store the old password hash as an array. Array values are auto | |
| 621 | + * sanitized by WordPress. | |
| 631 | 622 | */ |
| 632 | 623 | public function callback_savepass( $field, $row ) { |
| 633 | - $pass_array = array( | |
| 634 | - 'hash' => $field, | |
| 635 | - 'salt' => $row['salt'] | |
| 636 | - ); | |
| 637 | - | |
| 638 | - return $pass_array; | |
| 624 | + return array( 'hash' => $field ); | |
| 639 | 625 | } |
| 640 | 626 | |
| 641 | 627 | /** |
| 642 | 628 | * This method is to take the pass out of the database and compare |
| @@ -644,26 +630,16 @@ | ||
| 644 | 630 | */ |
| 645 | 631 | public function authenticate_pass( $password, $serialized_pass ) { |
| 646 | 632 | |
| 647 | 633 | // Unserialize the password, with safeguards |
| 648 | - $pass_array = unserialize( | |
| 649 | - $serialized_pass, | |
| 650 | - array( | |
| 651 | - 'allowed_classes' => false, | |
| 652 | - 'max_depth' => 1 | |
| 653 | - ) | |
| 654 | - ); | |
| 634 | + $pass_array = $this->unserialize_pass( $serialized_pass ); | |
| 655 | 635 | |
| 656 | - // Bail if missing values | |
| 657 | - if ( ! is_array( $pass_array ) || ! isset( $pass_array['hash'], $pass_array['salt'] ) ) { | |
| 636 | + // Bail if missing or invalid values | |
| 637 | + if ( ! is_string( $password ) || ! is_array( $pass_array ) || ! isset( $pass_array['hash'] ) || ! is_string( $pass_array['hash'] ) ) { | |
| 658 | 638 | return false; |
| 659 | 639 | } |
| 660 | 640 | |
| 661 | - // Return comparison | |
| 662 | - return hash_equals( | |
| 663 | - $pass_array['hash'], | |
| 664 | - md5( md5( $password ) . $pass_array['salt'] ) | |
| 665 | - ); | |
| 641 | + return hash_equals( $pass_array['hash'], md5( $password ) ); | |
| 666 | 642 | } |
| 667 | 643 | |
| 668 | 644 | /** |
| 669 | 645 | * Translate the forum type from XMB v1.9.11.13 Capitalised case to WordPress's non-capatilise case strings. |
